Microsoft Azure Storage handles all the encryption, decryption and key management in a totally transparent fashion. All data is encrypted using 256-bit AES encryption, also known as AES-256, one of the strongest block ciphers available. Customers can enable this feature on all available redundancy types of Azure Storage – LRS, GRS, ZRS, RA-GRS and Premium-LRS for all Azure Resource Manager Storage accounts and Blob Storage accounts. There is no additional charge for enabling this feature.

Note that SSE encrypts when blobs are written or updated. This means that when you enable SSE for an existing storage account, only new writes are encrypted; it does not go back and encrypt the data already present.